Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

WAF SSRF → IMDS → S3 mass exfil (Capital One 2019)

A misconfigured ModSecurity rule on a customer-facing app allowed SSRF; SSRF hit EC2 IMDSv1 for the instance role; the role had ListBucket + GetObject on a major customer-data bucket.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target operates AWS-hosted web apps with broad EC2 IAM role attachments. IMDSv1 still enabled. WAF rules occasionally introduce SSRF-class behaviour.

§ Steps

  1. 01
    Steal instance role credentialsCredential Access
    T1552— Unsecured Credentials
  2. 02
    Find SSRF primitive on the web appLateral Movement
    W-SSRF— Server-Side Request Forgery (SSRF)
  3. 03
    ListBucket via stolen roleCollection
    C-S3-EXFIL— S3 / Blob / GCS Mass Exfil
  4. 04
    Reach 169.254.169.254 IMDSv1Credential Access
    C-IMDS-V1— IMDSv1 Credential Theft
  5. 05
    Mass GetObject of customer dataInitial Access
    APT-CAPITAL-ONE-SSRF— Cloud SSRF → IMDS → Bucket Exfil (Capital One 2019)

§ References

§ Frequently asked

What is the "WAF SSRF → IMDS → S3 mass exfil (Capital One 2019)" attack path?
A misconfigured ModSecurity rule on a customer-facing app allowed SSRF; SSRF hit EC2 IMDSv1 for the instance role; the role had ListBucket + GetObject on a major customer-data bucket. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Steal instance role credentials (T1552) — a credential access primitive. Assumed environment: target operates AWS-hosted web apps with broad EC2 IAM role attachments.
What is the final impact of this kill-chain?
The final step lands on Mass GetObject of customer data (APT-CAPITAL-ONE-SSRF), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers